CVE-2026-8706

Vulnerability

Firefox for iOS hosted Reader mode on an unauthenticated local web server. This allows another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies [1]. The vulnerability affects versions prior to Firefox for iOS 151.0 [2].

Exploitation

An attacker would need a malicious application installed on the same device as the vulnerable Firefox for iOS. No authentication is required; the local web server is unauthenticated. The attacker's app can directly request any URL through the local server, and Firefox will return the response including the user's authenticated cookies [1].

Impact

A successful attack allows the malicious application to read responses from arbitrary URLs that are rendered with the user's signed-in cookies. This leads to disclosure of sensitive user data associated with those sessions [1].

Mitigation

The vulnerability is fixed in Firefox for iOS version 151.0 [1]. Users should update to that version or later. No workaround is available for earlier versions.